# Services Based Pentest Checklist

<details>

<summary><strong>Symfony PHP</strong></summary>

* [ ] Symfony Profiler Enabled

```
/app_dev.php
/app_dev.php/_profiler
/_profiler
/_profiler/latest
/_profiler/search
/_profiler/phpinfo
/_profiler/{token}
/_wdt/{token}
/app_example.php
/app_test.php
/index_dev.php
/config.php
/_configurator/
/_configurator/steps
/_configurator/step/{index}
```

</details>

<details>

<summary><strong>Laravel</strong></summary>

* [ ] Laravel Debug Mode / Telescope / Ignition / Horizon / Pulse

```
/.env
/_debugbar
/_debugbar/open
/_debugbar/clockwork/{id}
/telescope
/telescope/requests
/telescope/exceptions
/ignition/execute-solution
/ignition/update-options
/horizon
/horizon/api/*
/pulse
```

</details>

<details>

<summary><strong>WordPress</strong></summary>

* [ ] WordPress Debug / Config / XMLRPC / Users Enum

```
/wp-config.php
/wp-config.php~
/wp-config.php.bak
/wp-config.php.old
/wp-admin/install.php
/xmlrpc.php
/wp-json/wp/v2/users
/wp-json/wp/v2/users/{id}
/readme.html
/license.txt
/wp-includes/version.php
```

</details>

<details>

<summary><strong>Django</strong></summary>

* [ ] Django Debug Mode / Admin / Debug Toolbar

```
/.env
/admin
/admin/login
/debug
/__debug__
/static/debug_toolbar/
/djdt/
/djdt/debug_toolbar
```

</details>

<details>

<summary><strong>Rails</strong></summary>

* [ ] Rails Console / Info / DB / Pwned

```
/rails/info/properties
/rails/console
/rails/db
/pwned
/.env
/config/database.yml
```

</details>

<details>

<summary><strong>Express.js / Node.js</strong></summary>

* [ ] Debug Routes / Env / Config Exposure

```
/.env
/debug
/trace
/env
/config
/status
/version
```

</details>

<details>

<summary><strong>Flask</strong></summary>

* [ ] Flask Debug Mode / Console

```
/.env
/console
/debug
/flask.debug
/_debug
```

</details>

<details>

<summary><strong>GraphQL</strong></summary>

* [ ] Introspection Enabled / IDEs

```
/graphql
/graph
/graphiql
/graphql/console
/graphql.php
/graphiql.php
/api/graphql
/v1/graphql
/v1/explorer
/v1/graphiql
/altair
/playground
/graphql-playground
/graphiql/fiddle
```

</details>

<details>

<summary><strong>Next.js</strong></summary>

* [ ] Next.js Debug / Env / Dev Files

```
/.env
/.env.local
/.env.production
/_next/static/development
/api/debug
/.next/
```

</details>

<details>

<summary><strong>Strapi</strong></summary>

* [ ] Strapi Admin / Dashboard / Env

```
/admin
/dashboard
/.env
/strapi
/plugins/users-permissions
```

</details>

<details>

<summary><strong>Spring Boot</strong></summary>

* [ ] Actuator Endpoints / Jolokia / Hawtio

```
/actuator
/actuator/env
/actuator/beans
/actuator/mappings
/actuator/health
/actuator/info
/actuator/heapdump
/actuator/threaddump
/actuator/loggers
/actuator/conditions
/jolokia
/jolokia/exec
/hawtio
/api/hawtio
```

</details>

<details>

<summary><strong>ASP.NET</strong></summary>

* [ ] Debug / Trace / Config Exposure

```
/trace.axd
/elmah.axd
/Web.config
/web.config.bak
/web.config~
/App_config/connectionStrings.config
```

</details>

<details>

<summary><strong>PHP General</strong></summary>

* [ ] PHP Info / Config / Backups

```
/phpinfo.php
/info.php
/test.php
/php.ini
/php.ini~
/php.ini.bak
/server-status
/server-info
```

</details>

<details>

<summary><strong>Apache</strong></summary>

* [ ] Server Status / Info / Mod Pages

```
/server-status
/server-info
/mod_status
/.htaccess
/.htpasswd
```

</details>

<details>

<summary><strong>Nginx</strong></summary>

* [ ] Status / Stub Status

```
/nginx_status
/status
/stub_status
```

</details>

<details>

<summary><strong>Tomcat</strong></summary>

* [ ] Manager / Host Manager / Examples

```
/manager/html
/host-manager/html
/examples
/docs
/admin
```

</details>

<details>

<summary><strong>Kibana</strong></summary>

* [ ] Kibana Dashboard / Timelion / Console

```
/app/kibana
/app/timelion
/app/console
/api/console
```

</details>

<details>

<summary><strong>Elasticsearch</strong></summary>

* [ ] Cluster Info / Indices / Cat APIs

```
/_cat
/_cat/indices
/_cat/nodes
/_cluster/health
/_nodes/stats
/*/_search
```

</details>

<details>

<summary><strong>MongoDB</strong></summary>

* [ ] Mongo Express / Admin UI

```
/dbadmin
/mongo
/admin/mongo
/me
```

</details>

<details>

<summary><strong>Redis</strong></summary>

* [ ] Redis CLI / Web UI

```
/redis
/phpredisadmin
/redis-cli
```

</details>

<details>

<summary><strong>Docker</strong></summary>

* [ ] Docker API / Registry / Swarm

```
/_ping
/v1.41/info
/v1.41/containers/json
/v2/_catalog
```

</details>

<details>

<summary><strong>Swagger / OpenAPI</strong></summary>

* [ ] Swagger UI / OpenAPI Docs Exposure

```
/swagger
/swagger-ui
/swagger-ui.html
/swagger-ui/index.html
/api-docs
/v2/api-docs
/v3/api-docs
/openapi.json
/openapi.yaml
/redoc
```

</details>

<details>

<summary><strong>Grafana</strong></summary>

* [ ] Grafana UI / Public Dashboards / Health

```
/grafana
/grafana/login
/grafana/public-dashboards
/public-dashboards
/api/health
/api/search
```

</details>

<details>

<summary><strong>Prometheus</strong></summary>

* [ ] Prometheus UI / Targets / Metrics

```
/graph
/targets
/service-discovery
/metrics
/api/v1/status/config
/api/v1/targets
```

</details>

<details>

<summary><strong>phpMyAdmin / Adminer</strong></summary>

* [ ] Database Admin Panels Exposed

```
/phpmyadmin
/phpMyAdmin
/pma
/dbadmin
/adminer
/adminer.php
```

</details>

<details>

<summary><strong>MinIO</strong></summary>

* [ ] MinIO Console / Health Endpoints

```
/minio
/minio/login
/minio/health/live
/minio/health/ready
```

</details>

<details>

<summary><strong>General Misconfig Checks</strong></summary>

* [ ] Environment Files

```
/.env
/.env.local
/.env.production
/.env.example
/config.php
/configuration.php
/settings.php
```

* [ ] Backup / Source Files

```
/*.bak
/*.old
/*.txt
/*~
/backup
/backups
/*.sql
/*.zip
/*.tar.gz
```

* [ ] Directory Listing / Uploads

```
/uploads/
/files/
/assets/
/static/
/media/
/user_uploads/
```

* [ ] Git / SVN Exposure

```
/.git/
/.git/HEAD
/.git/config
/.svn/entries
/.hg/
```

</details>

<details>

<summary>Postman API Platform</summary>

* [ ] Public Workspaces

```
https://www.postman.com/{companyName}/?tab=workspaces
```

</details>

<details>

<summary>Salesforce</summary>

* [ ] Salesforce Lightning Aura Components Enabled

```
- Test:
POST /aura HTTP/2
Host: {TARGET}.lightning.force.com
Content-Type: application/json

{}
------------------------
- FQDNs:
*.force.com
*.secure.force.com
*.live.siteforce.com
---------------------------
- Other Endpoints
/sfsites/aura
/s/sfsites/aura
```

</details>

<details>

<summary>Trello</summary>

* [ ] View Permissions on Trello Boards

```
site:trello.com "company"
https://trello.com/b/{BOARD_ID}
```

</details>

<details>

<summary>Figma</summary>

* [ ] View access misconfiguration

```
https://www.figma.com/file/{DesignID}/{DesignFileName}
```

</details>

<details>

<summary>Freshworks Freshservice</summary>

* [ ] Open User Registration

```
https://<companyName>.freshservice.com/support/signup
```

</details>

<details>

<summary>Slack</summary>

* [ ] No Admin Approval for Invitations

To check if you have permissions to invite a new member:

1. Sign in to your Slack Workspace
2. Open any channel
3. Click on **Add people**
4. A popup will open up, enter the user's email address
5. Finally, click **Add**

These reproduction steps prove that you're able to invite new members without approval from an administrator.

![](https://bugology.intigriti.io/misconfig-mapper-docs/~gitbook/image?url=https%3A%2F%2F867675796-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FHax8VYP6nSo5n66iSR0Z%252Fuploads%252Fgit-blob-de8e86fddf7e79b52a5ffa21a075887e53797106%252Fimage%2520%285%29.png%3Falt%3Dmedia\&width=768\&dpr=4\&quality=100\&sign=3559249d\&sv=2)

</details>

<details>

<summary>Atlassian Bitbucket</summary>

* [ ] Publicly Accessible Private Repositories

```
https://bitbucket.org/{WORKSPACE_ID}
site:bitbucket.org inurl:/workspace/projects
```

</details>

<details>

<summary>Atlassian Confluence</summary>

* [ ] [Anonymous access to Remote API](https://bugology.intigriti.io/misconfig-mapper-docs/services/atlassian-confluence/anonymous-access-to-remote-api)

{% code overflow="wrap" %}

```http
## XML-RPC HTTP Request to retrieve a specific page for example:
POST /rpc/xmlrpc HTTP/1.1
Host: confluence.example.com
Content-Type: text/xml
...

<?xml version="1.0" encoding="UTF-8"?>
<methodCall>
 <methodName>confluence2.getPage</methodName>
 <params>
  <param>
   <value>
    <string>{SPACE_KEY}</string>
   </value>
  </param>
  <param>
   <value>
    <string>{PAGE_TITLE}</string>
   </value>
  </param>
 </params>
</methodCall>

--------------------------------
## Curl:
curl -X POST -H 'Content-Type: text/xml' -d '<?xml version="1.0" encoding="UTF-8"?><methodCall><methodName>confluence2.getPage</methodName><params><param><value><string>{SPACE_KEY}</string></value></param><param><value><string>{PAGE_TITLE}</string></value></param></params></methodCall>' http://confluence.example.com/rpc/xmlrpc

------------------------------------
## SOAP: /rpc/soap-axis/confluenceservice-v2
```

{% endcode %}

* [ ] [Disabled XSRF Protection](https://bugology.intigriti.io/misconfig-mapper-docs/services/atlassian-confluence/disabled-xsrf-protection)

{% code overflow="wrap" %}

```
In case XSRF Protection is turned off, bad actors could post comments on other user's behalf by just sending them a link to an attacker controlled site that replicates the POST request.
```

{% endcode %}

* [ ] [User Email Visibility](https://bugology.intigriti.io/misconfig-mapper-docs/services/atlassian-confluence/user-email-visibility)

{% code overflow="wrap" %}

```
There is no specific testing procedure for this misconfiguration. Email addresses are visible next to the user's name on posts for example.
```

{% endcode %}

* [ ] [Misconfigured Spaces](https://github.com/intigriti/misconfig-mapper-docs/blob/gitbook/services/atlassian-confluence/misconfigured-spaces.md)

{% code overflow="wrap" %}

```
Visit the following application route to check if anonymous users can view and read any information on Confluence Spaces:

https://<companyName>.atlassian.net/wiki/spaces
```

{% endcode %}

</details>

<details>

<summary>Atlassian Jira</summary>

* [ ] [Open User Registration](https://bugology.intigriti.io/misconfig-mapper-docs/services/atlassian-jira/open-user-registration)

{% code overflow="wrap" %}

```
You can cross-check if user registration is open for anyone by navigating to the following app route:

/secure/Signup!default.jspa
```

{% endcode %}

* [ ] [Misconfigured Email Visibility](https://bugology.intigriti.io/misconfig-mapper-docs/services/atlassian-jira/atlassian-jira-email-visibility)

{% code overflow="wrap" %}

```
Open up any user's profile in your Jira instance as an anonymous user and verify that you can view the email address of the user.
```

{% endcode %}

* [ ] [Open Service Desk registration](https://bugology.intigriti.io/misconfig-mapper-docs/services/atlassian-jira/atlassian-jira-service-desk-open-signups)

{% code overflow="wrap" %}

```
Navigate to the following app route and check if signups are enabled:

/servicedesk/customer/user/login
```

{% endcode %}

</details>

<details>

<summary>AWS S3</summary>

* [ ] Misconfigured List Permissions

```
aws s3 ls s3://{BUCKET_NAME} --no-sign-request
```

</details>

<details>

<summary>Cloudflare R2</summary>

* [ ] R2.DEV Enabled

{% code overflow="wrap" %}

```
You can make use of search syntaxis supported by several popular search engines like Google to enumerate R2 buckets belonging to your target company or organization:

site:.r2.dev "company"
```

{% endcode %}

</details>

<details>

<summary>Google Groups</summary>

* [ ] Misconfigured read permissions

```
site:groups.google.com "{companyName}"
```

</details>

<details>

<summary>Google Docs</summary>

* [ ] Misconfigured read permissions

```
https://docs.google.com/document/d/{documentId}/edit
```

</details>

<details>

<summary>Google Cloud Storage Bucket</summary>

* [ ] Misconfigured access controls

{% code overflow="wrap" %}

```
https://{companyName}.storage.googleapis.com/
https://storage.googleapis.com/{companyName}

Indexing can also be allowed, to cross-check, you can make use of search filters that search engines like Google provide:

site:storage.googleapis.com "{companyName}"
```

{% endcode %}

</details>

<details>

<summary>Google OAuth</summary>

* [ ] Unrestricted email domains

{% code overflow="wrap" %}

```
https://accounts.google.com/o/oauth2/v2/auth?
  response_type=code&
  client_id=1234.apps.googleusercontent.com&
  ...
  hd=company.com

--------------------------------
Change it to example.com:
--------------------------------

https://accounts.google.com/o/oauth2/v2/auth?
  response_type=code&
  client_id=1234.apps.googleusercontent.com&
  ...
  hd=example.com
```

{% endcode %}

</details>

<details>

<summary>Jenkins</summary>

* [ ] Open Signups

```
- Enumerate jenkist subdomains
jenkist.domain.com

- Check those endpoints
/signup
/jenkins/signup
```

* [ ] Public Groovy Script Console

{% code overflow="wrap" %}

```bash
- Check if Groovy Script Console is publicly accessible:

/script

---------------------------------
- Test:

curl -s 'https://jenkins.{HOST}/script' -X 'POST' --data 'script={SCRIPT}'

or:

curl -s 'https://jenkins.{HOST}/scriptText' -X 'POST' --data 'script={SCRIPT}'
```

{% endcode %}

</details>

<details>

<summary>GitLab</summary>

* [ ] Gitlab Private Source Code Snippets Exposed

{% code overflow="wrap" %}

```
/explore/snippets
```

{% endcode %}

</details>

<details>

<summary>Drupal</summary>

```
- Brute Force IDs
/node/{ID}
```

</details>

### Automation

{% embed url="<https://bugology.intigriti.io/misconfig-mapper-docs>" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://sallam.gitbook.io/sec-88/web-appsec/services-based-pentest-checklist.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.